CVE-2026-19900 is a vulnerability in LB-LINK X-PRO 1.0.22-20231206 where manipulation of an unknown function related to the /etc/shadow file leads to the presence of hard-coded credentials. This flaw allows remote attackers to potentially gain unauthorized access. The attack complexity is high, and no privileges or user interaction are required for exploitation. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, the vendor has not provided any response or patch.

Successful exploitation can lead to full compromise of the affected system due to hard-coded credentials, impacting confidentiality, integrity, and availability. Remote attackers can exploit this without privileges or user interaction, but the attack requires a high level of complexity. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting network access to the affected device and applying compensating controls to limit exposure.